Member registration fixed

server/api/membership/download/[id].get.js

@@ -1,5 +1,6 @@
 import fs from 'fs/promises'
 import path from 'path'
+import { createHmac, timingSafeEqual } from 'crypto'
 import { getUserFromToken } from '../../../utils/auth.js'
 import { getServerDataPath } from '../../../utils/paths.js'
 
@@ -47,7 +48,27 @@ export default defineEventHandler(async (event) => {
       }
     }
     
-    // Prüfen ob es sich um eine aktuelle Session handelt (innerhalb der letzten 24 Stunden)
+    // Native apps cannot reliably reuse the httpOnly browser cookie that is
+    // set when the application is created.  They receive the same short-lived
+    // authorization as a signed response token instead.
+    const signedDownloadToken = getHeader(event, 'x-membership-download-token')
+    if (signedDownloadToken) {
+      try {
+        const [payload, signature] = signedDownloadToken.split('.')
+        const secret = process.env.ENCRYPTION_KEY || 'local_development_encryption_key_change_in_production'
+        const expected = createHmac('sha256', secret).update(payload).digest('base64url')
+        const validSignature = signature && timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
+        const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'))
+        const tokenAge = Date.now() - Number(decoded.issuedAt)
+        if (validSignature && decoded.fileId === fileId && tokenAge >= 0 && tokenAge < 24 * 60 * 60 * 1000) {
+          isAuthorized = true
+        }
+      } catch (_error) {
+        // Invalid download tokens are treated as unauthorized.
+      }
+    }
+
+    // Browser clients continue to use the httpOnly cookie.
     const downloadToken = getCookie(event, 'download_token')
     
     if (downloadToken) {